test(acl,domain): cover the approval-flow mutants to hold the ratchet (refs #75)

The new gateway/use-case code left surviving mutants (empty NoCoverage on the ACL
gateway status-set, plus unasserted error messages, null-guards, and the persist
call). Add stub-handler tests for SetZaakToEindstatusAsync (eindstatus resolution,
POST framing, failure paths) and assert the approve use case's messages, null
handling and SaveAsync. Local Stryker: acl 100%, domain 98.4%, event-subscriber 100%.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/domain/Big.Tests/ApproveRegistrationTests.cs

@@ -27,6 +27,19 @@ public class ApproveRegistrationTests
         Assert.Equal(RegistrationStatus.Ingeschreven, saved!.Status);
         Assert.Equal(FakeAclClient.DefaultZaakUrl, acl.ApprovedZaakUrl);
         Assert.Equal(1, acl.ApproveCallCount);
+        // The approved aggregate is persisted (not just mutated in memory).
+        Assert.Equal(1, store.SaveCount);
+    }
+
+    [Fact]
+    public async Task Rejects_a_null_command_without_touching_the_store_or_acl()
+    {
+        var store = new FakeRegistrationStore();
+        var acl = new FakeAclClient();
+        var handler = new ApproveRegistration(store, acl);
+
+        await Assert.ThrowsAsync<ArgumentNullException>(() => handler.HandleAsync(null!));
+        Assert.Equal(0, acl.ApproveCallCount);
     }
 
     [Fact]
@@ -36,8 +49,9 @@ public class ApproveRegistrationTests
         var acl = new FakeAclClient();
         var handler = new ApproveRegistration(store, acl);
 
-        await Assert.ThrowsAsync<InvalidOperationException>(
+        var ex = await Assert.ThrowsAsync<InvalidOperationException>(
             () => handler.HandleAsync(new ApproveRegistrationCommand(RegistrationId.New())));
+        Assert.Contains("No registration", ex.Message);
         Assert.Equal(0, acl.ApproveCallCount);
     }
 
@@ -50,8 +64,9 @@ public class ApproveRegistrationTests
         store.Seed(registration);
         var handler = new ApproveRegistration(store, acl);
 
-        await Assert.ThrowsAsync<InvalidOperationException>(
+        var ex = await Assert.ThrowsAsync<InvalidOperationException>(
             () => handler.HandleAsync(new ApproveRegistrationCommand(registration.Id)));
+        Assert.Contains("no zaak", ex.Message);
         Assert.Equal(0, acl.ApproveCallCount);
     }